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FOREWORD 


y 

\ 

■^:This document constitutes Volume 4 of a seven-volume Final 
Report^prepared by Teledyne Brown Engineering, Huntsville, Alabama, 
under NASA Contract No. NASlO-8676, Launch Site Processing of 
Hazardous Payloads. .^This study required a thorough analysis of the 
impact on the launch site and its operations by hazardous Space Shuttle 
payloads. 

\ 

Tire seven volumes of the Final Report are as follows: 

Volume U EXECUTIVE SUMMARY: This volume presents 

a concise review o£ the results of the study tasks and summarizes the 
principal conductions and recommendations of the study* 


Volume 2. HAZARDOUS PAYLOADS SURVEY AND ANALYSIS : 
This volume presents the results of a survey and analysis of proposed 
Shuttle payloads to identify hazardous payloads and define the character- 
istics of materials and systems which make them hazardous. This task 
included the development of a hazardous payloads ranking technique 
and recommendations\for processing analysis on selected payloads* 

Volume 3. NORMAL PROCESSING ANALYSIS : This volume 

presents preliminary normal processing flow plans for three Shuttle 
cargoes selected as a result of the Hazardous Payloads Survey and 
Analysis Task. These three cargoes are: 

\ 

• Spacelab with^dvanced Technology Laboratory 

V 

• Tug, Solar Electric Propulsion Stage, and Synchronous 
Earth Observatory^Satellite 

\ 

• Interim Upper Stage and ^a.^Pioneer Jupiter Probe with 
a Fluorine Propulsion Unit 

The preliminary processing flow plans include identification 
of unique facilities and GSE, processing hazards, and payload safety 
related design criteria. 

Volume 4. CONTINGENCY PROCESSING ANALYSIS: ^This 
volume presents preliminary alternate processing flow plans for 
contingency situations for the three Shuttle cargoes analyzed in the 
Normal Processing Analysis Task, y-:.- . 
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Volume 5. CURRENT PAYLOADS SURVEY AND ANALYSIS: 
This volume presents the results of a survey and analysis to determine 
payloads that are currently flying and that may also fly on the Shuttle 
vehicle when it becomes operational. The analysis determines hazard- 
ous mate rials / systems for each of these current payloads and recom- 
mends design and operational safety criteria for each hazardous current 
payload to minimize its impact on the Shuttle Transportation System. 

Volume 6. ENVIRONMENTAL IMPACT STATEMENT 
POTENTIAL REQUIREMENTS: This volume presents the results of an 

evaluation of the probable environmental impact of Shuttle payloads 
hazardous materials and includes recommended KSC Environmental 
Impact Statement Potential Requirements. 

Volume 7. ADVANCED TECHNOLOGY REQUIREMENTS: 

Thi; volume presents a list of special problems identified in the study 
whic . require advanced technology study or technology development. 
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1.0 INTRODUCTION 

Payloads containing hazardous materials associated with 
space vehicle launch operations have been recognized and dealt with on 
previous R&D space programs. However, when compared to the Shuttle 
Program, these R&D space programs involved relatively few launches 
with considerable time between launches. The Shuttle operational pro- 
gram will have a high launch rate and in many cases individual launches 
will have several independent payloads for accomplishment of separate 
missions. Some of these payloads by intent will be recoverable for pur- 
pose of reuse, and all must be recoverable in the sense that possible 
abort situations prior to deployment have to be recognized. 

Present processing schedules have been derived assuming 
nominal passive payloads and nominal payload flow time, A number of 
specifically safety oriented studies on Shuttle payloads has been per- 
formed in recent years. However, relatively few of these have treated 
ground operations in depth, and the overall impact of Shuttle payload 
hazards on launch and landing site processing and procedures has not 
been documented. In order to fill this gap, this 10-month study was 
initiated in July 1974, The overall study objectives were to uncover and 
determine the hazard potential of Shuttle payloads, develop safety 
oriented normal and contingency launch site processing plans for selected 
cargoes that will minimize the impact on cost and schedules, and pro- 
vide for environmental protection. 

1. 1 TASK OBJECTIVES 

The objective of contingency analysis is to derive a set of alter- 
native plans for emergency situations that can arise during the proc- 
essing of hazardous payloads, 

1.2 SCOPE 

Since a contingency is any deviation in the set of conditions from 
which the normal base line processing was planned, there are many 
types of contingency situations ranging from schedule problems, failures 
or malfunctions and human errors, to accidents occurring during the 
processing operations. All of these types of contingencies need alter- 
native plans if a return to normal or near normal operation is to be 
obtained or if a safe and effective backout with minimum damage to facilities 
and equipment, minimum injury, and minimum loss of time are to be expected. 
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In this study, the approach has been to analyze two categories 
of contingencies that involve cargoes; 

• Contingencies not directly related to payload/cargo but occur 
while the cargo is Orbiter constrained. 

• Contingencies directly related to payload/cargo and initiated 
by the occurrence of payload /cargo processing accidents. 

In the first category, the concentration has been on the analysis of 
certain contingency situations that have wide and diverse applications 
and cover, in a general sense, most of the Orbiter constrained contin- 
gency conditions. Table I lists six types of contingencies (i. e., from 
the first category) versus the three cargoes, 

TABLE I. CONTINGENCIES VERSUS CARGOES 


TYPE OF CONTINGENCY 

CARGO 

SPACELAB/ATL TUG/SEPS/SEOS IUS/F 2 PU/PJP 

1. BACKOUT OPERATIONS 

• • • 

2. VERTICAL CHANGEOUT AT THE PAD 

• • • 

3. MISSION ABORT 

• • • 

4. NORMAL LANDING AT CONTINGENCY 

• • 

SITE 


5. CRASH /SHOCK CONDITION LANDING 


AT KSC 

• • 

6. CRASH /SHOCK CONDITION LANDING 


AT ALTERNATE SITE 

• • 


In addition to developing the 15 contingency plans shown above, one 
accident-type contingency, loss of Radioisotope Thermoelectric Generator 
(RTG) cooling was selected from the list of accident candidates, and a plan 
for loss of RTG cooling was developed. 

For each of the 16 contingencies analyzed in this study, the 
following is being provided: 
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• An alternative flow plan for proceeding with near normal 
operations or for backing out with minimum loss. 

• A waterfall/ time line chart of the alternative flow for 
estimating schedule impact. 

• A summary of special safing requirements. 

• An identification of special support equipment. 

1.3 TASK APPROACH 

The approach for developing the contingency package is: 

• Define the Objective, e. g. , safe the cargo, backout from 
online operations, and demate as rapidly as possible. 

• Identify safest and least time consuming operational 
sequence {an iterative process). 

--Define a workable operational flow to satisfy the 
objective. 

--Remove hazardous operations or, where possible, 
change the sequence to a less hazardous flow. 

--Identify parallel activities. 

• Identify special support equipment requirements, facility 
protection, and personnel safety requirements. 

1.4 SUMMARY OF RESULTS AND RECOMMENDATIONS 

Normal feasible processing plans for the cargoes consisting of 
Spacelab/ ATL/IRTCM, Interim Upper Stage (lUS)/ Fluorine Propulsion 
Unit (F 2 PU)/Pioneer Jupiter Probe (PIP), Tug/Solar Electric Propulsion 
Stage (SEPS)/Synchronous Earth Observatory Satellite (SEOS) were 
optimized through a series of iterative tradeoffs. These final iterations 
formed the normal base line processing flow plans. They were analyzed 
for weaknesses and susceptibility to hazards. Areas revealed to be 
particularly vulnerable to catastrophic and critical accidents were flagged 
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for further consideration as candidates for contingency planning. Also, 
an examination of the normal base line processing flow for the areas of 
highest accident potential because of heavy hazard concentrations or 
caused by other considerations, such as the cargoes* being Orbiter 
constrained, indicated the need for contingency planning for pad backout 
operations, vertical changeout options at the pad, and mission abort 
plans. The base line processing flow covered landing and refurbishment 
operations for the Spacelab/ATL/IRTCM and Tug/SEPS/SEOS. In this 
task, normal landing at a contingency site as well as crash/ shock 
condition landings at both KSC and at a contingency site were studied. 
Thus, a set of six general types of contingency plans was developed for 
these two cargoes. For the lUS/ F^PU / PJP, contingency planning for 
landing operations was not studied. A total of 1 5 general contingency 
plans was developed. 

From the list of candidate accident contingencies, one accident- 
type contingency (loss of RTG cooling for the PJP on the IUS/F2PU/PJP 
cargo) was selected for analysis. In addition to providing the contingency 
plans in flow chart form, the operations were timelined and a waterfall 
chart was derived for determining schedule impact on the normal 
processing operations. From an analysis of each contingency plan, 
essential facility modifications and special support equipment required 
for the successful deployment of that plan have been compiled and 
described. 

The primary findings, conclusions, and recommendations 
resulting from the contingency analysis are as follows: 

• Fluorine 

--The consequences of a major fluorine leak at landing 
during mission abort of the IUS/F2PU/PJP cargo 
make it desireable that F^ be dumped in space. 

--Mission abort and in-flight dump require a special F2 
vent and dump line. The Orbiter oxidizer dump system 
could be used (other oxidizers are primarily LO2 and 
^ 2 ^ 4 ^* This requires that the Orbiter oxidizer over- 
board vent systems* design and materials be F2 
compatible. 
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--Purge tanks should be provided for F2 tank purge and 
inerting following in-flight dumping during abort. This 
is to remove residuals before landing, 

--For mission abort of IUS/F2PU/PJP when F2 is dumped 
in-flight, it is recommended that final inerting of F2 
system be conducted at the landing strip or an intermediate 
facility before return to the Orbiter Processing Facility (OPF). 
This requires a heated GN2 supply, a portable F2 vent line 
system, and a disposal unit, 

--(Alternate) If F^ is not vented in-flight when the mission 
is aborted and the system remains intact through landing, it 
is recommended that the fluorinated propulsion unit be removed 
at the OPF and transferred to the facility for unloading. 

This requires a portable TN2 cooling supply at the landing 
strip, 

--Fluorine unit should be removed intact during pad backout 
or vertical changeout contingency unless a failure has 
occurred in the fluorine system, 

--Payload Changeout Room (PCR) should have provisions for 
bringing supply dewar to F2PU level, 

--Fluorine drain and disposal unit is required at the pad, 

• Mercury 

--Because of the consequence to the Orbiter from a major 
mercury leak at landing (contamination), it is recommended 
that mercury propellant be dumped before return in a 
mission abort situation. 

--Mercury dump for abort could be through the Orbiter 
propellant vent system. The Mercury propellant vent 
line size should be studied, 

--If mercury dumping is not performed for mission abort, 
the bladder must be pressurized during landing. The SEPS 
structure should be evaluated for 3000 -lb shift of mercury. 
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--Mercury should not be removed from the SEPS for pad 
backout or vertical changeout contingencies. 

--All Mercury transfer should be performed at the Mercury 
facility. 

• Radiological (RTG’s) 

--RTG's will require a portable cooling unit at the landing 
strip for the mission abort contingency. 

--Cooling system (onboard) should be designed for complete 
redundancy. It is suggested that the coolant shrouds have 
alternate coils supplied by separate systems. 

--The RTG water cooling system integrity must be leak 
proof, i, e, , considered the same as a hazardous fluid. 

--The RTG water cooling should have relief valve and the 

cooling shroud and RTG unit should have a temperature monitor. 

--Design of the RTG/Radioisotope Heater Unit (RHU) should be 
such that integrity of the units would be maintained in the 
event of a fire or explosion. 

--Requires presence of trained and equipped radiological 
survey/ decontamination teams. 
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2.0 CONTINGENCY SELECTION 


Contingency selection is a logical process of analytically search- 
ing the normal base line processing flow for the most likely and cata- 
strophic contingencies, examining possible alternative courses of action, 
and selecting the overall most desirable alternative from the candidates 
for implementation. 

This process is illustrated in Figure 1. The first step m the 
contingency selection process is the identification of potential contingency 
situations. One of the main thrusts of this study has been the perform- 
ance of a hazard analysis on the base line processing flow for the three 
cargoes. The hazard analysis has provided in-depth visibility for identi- 
fying potential contingency situations through recognition of hazardous 
operations, processes, materials, and systems. Since the hazard 
analysis covered the entire spectrum of ground processing operations 
and categorized hazards according to severity of impact, accident -type 
candidate contingency situations could be derived for various operations 
or events. In addition to using the hazard analysis as a vehicle for 
locating specific contingency situations, six general contingency situa- 
tions in which wide spread interest has been shown were selected and 
developed. These contingencies shown in Paragraph 1. 2 are not directly 
related to payload/ cargo but occur while the cargo is Orbiter constrained. 

Once a potential contingency has been identified (step one) and a 
need for an alternative flow has been decided upon, possible alternative 
courses of action must be examined (step two). For example, the con- 
tingency situation will be bumped against basic types of alternatives - - 
workarounds, repair /replace and proceed, and changeout payload. For 
each feasible course of action, a rough estimate of its overall impact 
(step three) is made to assist in selecting the most desirable alternative 
(Step 4), 
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The development of the normal processing base line flow was an 
iterative process of continually improving a workable processing plan 
until the best overall compromises in safety, schedule time, and 
facilities /equipment had been achieved. Through this feedback process, 
some hazardous operations were either eliminated, reduced, or re- 
placed by less hazardous ones, or the sequence and/or locations 
changed so as to have a lesser impact. In essence, tradeoffs consider- 
ing the above parameters of safety, time, and facilities were made in 
arriving at an intuitive optimum base line flow. This process is typified 
in Figure 2, which illustrates by a simple example the replacement of a 
section of the normal processing base line with an alternative method. 

The implication is that the analysis of the normal base line revealed a 
hazardous sequence of operations that can be replaced entirely by an 
alternative sequence that will then become an integral part of the optimum 
normal processing base line flow. 

The detailed hazard analysis was performed on the optimum 
normal processing base line flow. The critical and catastrophic hazards 
uncovered as a result of this analysis were treated through recom- 
mendations designed to control them, or in lieu of appropriate or suit- 
able recommendations an alternative flow for an accident -type contingency 
was proposed. This type of alternative is not to be mistaken for the 
previously discussed type of alternative that replaces another more 
hazardous sequence of operations in the iterative process of optimizing 
the normal base line processing flow. The alternative for a contingency 
situation is not an integral part of the normal base line processing flow 
but an alternative path to be used in the event that the undesired con- 
tingency occurs. 

The alternative flows for contingencies of the three cargoes 
{i. e. , Spacelab/ATL/IRTCM, Tug/SEPS/SEOS, and lUS/F^PU/PJP) are 
discussed in Paragraphs 3. 1, 3. 2 , and 3. 3. A brief narrative descrip- 
tion of each contingency alternative is presented with a discussion of 
the operational flows, time lines, and summary of safing requirements. 
Constraints and areas of major design impact are also noted. It should 
be emphasized that these contingency flows, time lines, and safing 
requirements have been developed for the purpose of providing the 
safest method of return to a normal or near -normal condition. Depending 
upon the initiator of a contingency situation, some of the desired safety 
precautions and constraints may have to be omitted if a catastrophic 
situation is imminent. This would require for each situation that a 
comparison be made of the relative risk from proceeding on a contingency 
plan in a less safe manner versus the risk of an imminent catastrophic 
condition. 
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3.0 CONTINGENCY ANALYSIS 


3. 1 SPACELAB/ATL/IRTCM CARGO CONTINGENCY PLANS 

3. 1. 1 Vertical Change out at the Pad 

This alternative is for those situations where the decision is 
to remove the Spacelab/ATL/IRTCM cargo at the pad and to replace it with 
another cargo. This is a general -type contingency situation and the 
specific cause or reason for the decision to change out is not defined. 

If the reason were because of an accident, a failure, etc. , the specific 
reason would have to be addressed and the peculiarities of the cause 
would have to be treated. This alternative plan requires two canisters: 
one that contains the Spacelab/ATL/IRTCM cargo and one on standby that con- 
tains an optional cargo. The problem of having a payload changeout 
room capable of handling two cargoes simultaneously was not addressed 
in this alternative because it will be presented in the flows of the lUS/ 
FoPU/PJP cargo. 

3, 1. 1. 1 Time Line 

The vertical changeout from initiation of the contingency to 
launch of the new cargo is approximately 75 hr. The operations required 
to remove the Spacelab and the sequence are shown on Figures 3 and 4. 

A nominal time line and sequence of operations for installation of another 
payload in the Orbiter are shown. Since there are no provisions for 
installation of a Spacelab cargo in the Orbiter in the vertical position, 
installation steps for the new cargo are at a level to be applicable to 
any payload. 

3. 1. 1. 2 Safing Requirements 

Depending upon the point in the Shuttle countdown where the 
vertical changeout contingency operation is initiated, the safing require- 
ments that must be completed to ensure safety of operations personnel 
and protection of facilities and the payload are as follows: 

• The Shuttle must be de serviced and safed and the pad 
reopened. 

• Spacelab GO 2 /GN 2 pressure bottles should be vented 

to remove the high pressure hazard. The current ESRO 

















FIGURE 4. SPACELAB/ATL VERTICAL CHANGEOUT AT THE PAD TIME LINE 
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Spacelab design provides a nonpr opulsive vent on the 
forward bulkhead of the Spacelab that dumps into the 
cargo bay. Venting of should present no special 
problems. However, venting of or 

may increase chances of a fire hazard in the cargo bay. 
Either the O 2 /N 2 vent line should be connected to the 
Orbiter vent system or ©2 venting must be accompanied 
by a high flow rate air or N 2 cargo bay purge. 

• Disconnect all pyrotechnics and install shorting plugs. 
This safing requirement will have a significant impact 
on the Spacelab design and require access in the vertical 
position from the cargo bay if done at the pad. This 
would also require special access platforms /mechanisms 
such as is shown in paragraph 3.5, Item C-1. 


• An alternate to pyrotechnics safing at the pad would be 
to perform this function upon arrival at the OFF as is 
done in the normal post flight operational sequence. 

This approach exposes the operational personnel to a 
hazard from inadvertent actuation of the boom jettison 
systems since access will be required to manually dis- 
connect the utility bridge and disconnect the tunnel. If 
this approach is required because of access limitations, 
mechanical safe and arm devices should be included in 
the design of all pyrotechnics or mechanical release 
devices should be used rather than pyrotechnics. 

• Removal of the Spacelab requires separation of the Freon 
Thermal Control System (TCS) loop that interconnects the 
Spacelab ECS system and the Orbiter radiator. Drain, 
flush, and purge of these lines are not considered necessary 
for safing prior to Spacelab removal but present a 
contamination problem. It is recommended that the 
Freon system be designed so that a disconnection when 
charged is possible with minimal leakage, 

3. 1. Z Backout Operations 

The backout contingency like the changeout contingency is a 
general flow that is applicable to any Spacelab cargo. Because it is 
general, specific reasons (such as a particular type of accident being 
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the initiating cause of the backout) are not addressed in this flow. 

The assumption is that the cause is controllable or has been arrested, 
thus presenting no special or unique fix at the pad. 

3. 1, 2. 1 Time Line 

The backout operation from initiation of backout to arrival 
at the O&C Building with the removed payload is approximately 3 5 hr. 
The operations required to perform the Spacelab removal and 
their sequence are shown in Figures 5 and 6. 

3. 1. 2. 2 Safing Requirements 

The safing requirements for this contingency are identical to 
the Spacelab vertical changeout operations given in paragraph 3, 1, 1. 2. 

3. 1. 3 Mission Abort 


This contingency requires in-flight safing of the Orbiter and 
cargo. Our primary concern, however, is with the cargo. Since the 
abort can take place at various points within the mission, cargo related 
safing must be examined in light of the worst case assumption that 
various experiments could be in process and thus must be dealt with 
accordingly. 

3. 1. 3. 1 Time Line 

The mission abort contingency flow is shown in Figure 7. The 
time required to safe the cargo for abort depends upon the operations in 
progress and time into the mission. Because of the number of possible com- 
binations of operation, a time frame is impractical to determine. 

3. 1. 3. 2 Safing Requirements 

The following safing operations must be performed for a 
mission abort and return to a normal landing. 

• All booms and antennae that are deployed at the time of 
the abort decision must be retracted or jettisoned if 
unable to retract because of a mechanical malfunction 
or insufficient time. Included in this operation is safing 
of all unexpended ordnance. 
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FIGURE 5, SPACEIvAR/ATL BACKOUT FLOW 




FIGURE 6, SPACELAB/ATL BACKOUT TIME EINE 
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FIGURE 7. SPACELAB/ATL MISSION ABORT FL 
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• All other experiments must be shut down and safed and 
pressures vented. 

• Bacterial cultures must be safed and secured. 

• GO 2 and GN 2 pressure bottles must be vented. The ESRO 
Spacelab design currently provides a nonpropulsive vent on 
the forward bulkhead of the Spacelab for venting into the 
cargo bay. Since the first abort opportunity is at Solid 
Rocket Booster (SRB) burnout 140, 000 ft), O 2 /N 2 vented 
into the cargo bay would be dispersed to space through the 
vent ports. 

• Ivliscellaneous equipment, tools, and flight articles should 
be secured and the Orbiter sealed off from the Spacelab 
prior to power removal. 

3.1.4 Normal Landing at a Contingency Site 

This is a general-type contingency situation where the Spacelab 
cargo is Orbiter constrained, and to adequately handle the cargo, atten- 
tion must be concentrated on the Orbiter requirements first. The 
decision to land at a contingency site may or may not be a result of a 
prior mission abort. The contingency flow developed for landing at a 
contingency site was for the worst case. It was assumed that the site 
was not prearranged for an Orbiter landing and had no special support 
equipment and no special trained maintenance personnel for the post- 
landing tasks. It was further assumed that as much Orbiter safing as 
possible will be performed with the types of equipment that can be 
brought to the contingency site. Another assumption made to establish 
this contingency was that a special equipped carrier plane such as a 
Boeing 747 would bring the required support equipment to the site and 
also return with it and the Orbiter to KSC. It was also assumed that 
the Spacelab film, recorded data, and microbiological cultures could 
be removed at the contingency site if it were considered imperative. 

3. 1. 4. 1 Time Line 

The normal landing at a contingency site flow is shown in 
Figure 8. The time required to safe and prepare the Orbiter and payload 
for transport to KSC depends upon the distance and time of arrival of 
personnel and equipment. The time line for this contingency is shown 
in Figure 9. 
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FIGURE 8. SPACELAB/ATL LANDING AT ALTERNATE SITE FLOW 





FIGURE 9, SPACELAB/ATU LANDING AT ALTERNATE SITE TIME LINE 
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3. 1. 4. Z Safing Requirements 

Safing requirements for the Spacelab are performed in 

flight. 

3, 1. 5 Crash/Shock Condition Lianding at KSC 

Crash/shock condition landing is a hard or rough landing with 
the potential of producing landing gear damages, hazardous leakages, 
etc. , that could ultimately result in a critical or catastrophic condition. 
The precautions to be taken are similar to those required for aircraft 
forced to make an emergency landing. Rescue personnel and fire 
suppressant equipment should be ready on the landing strip in case of 
fire. Of primary concern in this contingency is crew evacuation. After 
crew evacuation, an inspection is made of the Orbiter's landing gear 
to determine its ability to be towed off the landing strip and to the OPF. 

3. 1. 5. 1 Time Line 

The crash/shock landing at KSC contingency flow is shown 
in Figure 10. The time required from landing to transport to the OPF 
is indefinite based on the condition of the Orbiter and, leakage of pro- 
pellants or hazardous fluids. The time line is shown on Figure 11, 

3. 1. 5. 2 Safing Requirements 


Safing requirements for the Spacelab are performed in flight. 


3. 1. 6 Crash/Shock Condition Landing at a Contingency Site 


The same basic assumptions that applied for landing at a 
contingency site and crash/ shock condition landing at KSC are also appli- 
cable for this contingency. This contingency plan allows for a waiting 
period if severe leakages were sustained prior to continuing with the 
safing activities. This is an indeterminate time period and, depending 
upon the severity of the leakages and the type of materials, may require 
a different sequence of events. 

3, 1. 6. 1 Time Line 

The crash/ shock condition landing at a contingency site 
flow is shown in Figure 12, The time required from landing 
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FIGURE 10. SPACELAB/ATL CRASH/SHOCK LANDING AT KSC FLOW (SHEET 1 of 2) 
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FIGURE 12, SPACELAB/ATL CRASH/SHOCK LANDING AT ALTERNATE SITE FLOW (SHEET 1 o£ 2) 
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to transport to KSC depends upon the distance and time to arrival of 
personnel and equipment. The time line for this contingency is shown 
in Figure 1 3, 

3. 1. 6. 2 Safing Requirements 

Safing requirements for the Spacelab are performed in 

flight. 

3. 2 TUG/SEPS/SEOS CARGO CONTINGENCY PLANS 

3. 2. 1 Backout Operations 

This contingency is a general flow applicable to any Tug 
cargo and makes no unique paylo?d requirements. It is 

assumed that the reason for the backout is controlled. If a specific pay- 
load or cargo related cause were to be identified that required a fix or 
remedial action as a prerequisite to backout safety, it could be in- 
corporated into this general flow. The operational steps required for 
this contingency are shown in Figure 14. 

3. 2. 1. 1 Time Line 

The time line for the Tug/SEPS/SEOS backout operation is 
shown in Figure 15. The time required for safing and removal of the 
payload from initiation of contingency operations to return to SAEF #1 
(TPF) is approximately 34 hr. 

3. 2. 1.2 Safing Requirements 

The following is a summary of constraints anc safing require- 
ments that must be performed during the backout operations. 

• Drain and purge Tug LH 2 , fuel cell H 2 , and External 
Tank (ET) LH 2 through Orbiter umbilicals. 

• Drain and purge Tug LOX, fuel cell O 2 , and ET LOX 
through Orbiter umbilicals, 

• Vent Tug LOX and LH 2 pressurants. 

• Vent Orbiter Reaction Control Subsystem (RCS), Orbital 
Maneuvering System (OMS), and Accessory Power Unit 
(APU) pressurants; drain PSRD propellants. 
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FIGURE 13. 5PACELAB/ATE CRASH/SHOCK LANDING AT ALTERNATE SITE 

TIME LINE 














figure 14. TUG/SEPS/SEOS BACKOUT OPERATIONS FLOW (SHEET 2 o£ 2) 




FIGURE 15. TUG/SEPS/SEOS BACKOUT OPERATIONS TIME LINE 
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• Connect service lines and vent Tug, SEPS, and SEOS 
APS pressurants; vent SEPS Main Propulsion System 
(MPS) pressurants. 

• Verify that no hazardous gases are present in the cargo 
bay. The variety of hazardous materials (EH 2 , LOX, 
hydrazine, mercury) indicates the need for a hazardous 
gas analyzer in the cargo bay (at the pad). 

• Verify checklist of cargo control, and warning system 
and remove payload power, 

• Separation of the SEOS or the SEPS/SEOS requires 
safing of separation ordnance and installation of 
shorting plugs. This operation requires access from 
the PCR to all cargo pyrotechnic initiating devices 

and may severely impact the payload design. The same 
access is required for attaching the changed out payloads 
to the Tug or the Tug /SEPS. 

3, Z, 2 Vertical Changeout at the Pad 

This contingency covers the safing of the Shuttle and cargo 
and addresses three options: 

• Assumes a malfunction or accident, etc. , has occurred 
requiring that the SEOS be changed out. 


« Shows a changeout of the SEPS/SEOS assembly. 

• Examines the option of changing out the entire Tug/SEPS/ 
SEOS cargo. 

The last option did not consider the requirement of the payload change- 
out room having the capability of handling two cargoes simultaneously 
because this problem was addressed in the IUS/F 2 PU/PJP cargo. 

The operational steps required for this contingency operation 
are shown in Figure 16, This vertical changeout contingency is initiated 
prior to servicing disconnect. If this contingency is initiated later in 
the processing flow, a reconnect of the Orbiter and payload service 
umbilicals would be required. The pad is cleared during propellant 
drain operations. 
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FIGURE 16. TUG/SEPS/SEOS VERTICAL CHANGEOUT AT THE PAD FLOW (SHEET 1 of 2) 






FIGURE 16. TUG/SEPS/5EOS VERTICAL CHANGEOUT AT THE PAD FLOW 
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3. Z. 2. 1 Time Line 

The time line for the Tug /SEPS/SEOS vertical changeout con- 
tingency is shown in Figure 17, If the SEOS payload is changed out, 
the time from initiation of the contingency operation to return to normal 
processing is approximately 32 hr. If the SEPS/SEOS payloads are 
changed out together, the time from initiation of the contingency opera- 
tion to return to normal processing is approximately 32 hr. If the 
Tug /SEPS /SEOS cargo is changed out, the time from initiation of the 
contingency operation to launch of a new cargo is approximately 
80 hr. 


The time lines for changeout of the SEOS only and the SEPS/ 

SEOS assume that the new payloads are at the pad when the contingency 
operations are initiated. The time line for changeout of the Tug/SEPS/ 

SEOS cargo requires retraction and extension of the Payload Changeout 
Room (PCR) twice, 

3. 2. 2. 2 Safing Requirements 

Safing requirements for the Tug/SEPS/SEOS vertical changeout 
contingency are identical to those for the Tug/SEPS/SEOS backout operations 
except that the pyrotechnics need not be removed but only safed and shorting 
plugs installed. 

3. 2. 3 Mission Abort 


The mission abort contingency plan for the Tug/SEPS/SEOS 
cargo is shown in Figure 18. The majority of the operational steps 
called out are monitoring and control functions of the Tug. The required 
operations for a mission abort of this cargo need further definition and 
additional study. A summary of the findings of this contingency analysis 
is as follows: 

• A rough cut analysis of the cargo weights when only Tug 
LOX and LH^ are dumped indicate that the cargo center 
of gravity is within the Shuttle envelope requirements and 
total weight requirements for landing. Therefore, Mer- 
cury dumping is not required because of weight and cargo 
center of gravity limitations. 

# Since this cargo is attached to the Shuttle by the Tug 
only, the cantilever effects on the Tug structure and 
adapter attach points at landing should be evaluated 

to take into account the momentum shift of the 3000 lb 
of mercury. 
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FIGURE 17. TUG/SEPS/SEOS VERTICAL CHANGEOUT AT THE PAD TIME LINE 




FIGURE 18. TUCi/SEPS/SEOS MISSION ABORT FLOW 
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• Dump the Mercury if the momentum shift of the 3000 lb 
of Mercury has not been taken into account, 

• If the design is such that in-flight dumping is not required, 
Mercury tanks should remain pressurized or be pres- 
surized to the operating level to assist in maintaining the 
Mercury tank bladder integrity. Design of the tanks in an 
*’upside down" configuration would relieve stress on the 
tank bladders at landing but would subject the bladders to 
liftoff "g" loads. The design of the mercury tanks should 
minimize the ullage volume. 

• A study should be performed to determine the effect of a 
mercury cloud/ dispersion on the atmosphere and ecology. 

• Alternate methods of dumping, optimum particle droplet 
size, and time for dumping should be further studied 

az the development of the SEPS kick stage progresses, 

3, 2. 3. 1 Time Line 

A nominal time line for the mission abort contingency opera- 
tions is shown in Figure 19. The dumping of mercury is shown as an 
option with no time specified. 

3. 2. 3. 2 Safing Requirement 

Safing requirements shown in the contingency flow include: 

• Tug LOX and LH^ tanks are dumped out through 

the T-O umbilical, purged, and partially repressurized 
for landing. The Tug LH 2 tank is vented and purged at the 
landing strip {normal operation). 

• From a Shuttle safety standpoint, it is desirable to dump 
the mercury propellant. However, the effects of this 
action need to be determined as to the effect on the 
ecology. 
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FIGURE 19. TUC/SEFS/SEOS MISSION ABORT TIME LINES 
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• All SEPS and SEOS pressurants (APS and MPS) should 
be vented and Tug fuel cell vented but still 

maintain a positive pressure. 

3. 2. 4 Normal Landing at a Co ntingency Site 

Due to Orbiter constraints, very little can be done to the 
Tug cargo for this contingency plan* The decision to land at a contingency 
site may or may not be a result of a prior mission abort* If landing 
at a contingency site had been preceded by a mission abort, then the 
Lox and would have been dumped, the tanks purged, as well as 

the multilayer insulation purged, just as during a normal flight. 

3. 2. 4. 1 Time Line 

The normal landing at a contingency site flow is 
shown in Figure 20. The time required to safe and prepare the Orbiter 
and payload for transport to KSC depends upon the distance and time to 
arrival of maintenance personnel and support equipment. The time line 
for this contingency is shown in Figure 21. 

3. 2. 4. 2 Safing Requirements 

The following constraints and Tug safing requirements for 
normal landing at a contingency site are: 

• Monitor cargo caution and warning functions. 

• Vent hydrogen, 

• Additional helium purge of propellant tanks and 
Multilayer Insulation (MLI), 

These Tug safing requirements are performed in conjunction with the 
following Orbiter activities: 

• Perform Safety Verification 

• Deactivate and secure Orbiter, 

• Shut Off Auxiliary Power Unit. 

• Install Mobile Ground Purge Unit, 
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FIGURE 21. TUG/SEPS/SEOS NORMAL LANDING AT ALTERNATE SITE TIME LINE 
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After mobile ground power for status display and cooling has been 
connected, the following operations are performed while cargo 
monitoring is continued: 

• Fuel cells shut down and vented. 

• High pressure gases are vented. 

• OMS and APU exhaust manifold are vented and purged, 

• Modules are deserviced. 

3. 2. 5 Crash/Shock Condition Landing at KSC 

Crash/shock condition landing is a hard or rough landing with 
the potential of producing landing gear damages, hazardous leakages, etc, , 
that could ultimately result in a critical or catastrophic condition. With 
the exception of landing gear damages, the most hazardous damage 
would primarily be internal and may not be detected through the caution 
and warning system until they had progressed to a potentially critical 
or catastrophic condition. Once the crash/shock condition has been 
sustained, the crew's safety is paramount and crew evacuation would 
be the immediate requirement. 


3, 2. 5. 1 Time Line 

The crash/ shock condition landing at KSC contingency flow 
is shown in Figure 22, The time required from landing to transfer to 
the OPF is an indefinite time frame and is based upon the following: 

• Condition of the Orbiter 

• Leakage of propellants or hazardous fluids. 

The time line for this contingency plan is shown in Figure 23. 

3. 2. 5. 2 Safing Requirements 

Safing requirements for this contingency plan are primarily 
Orbiter related. Prior to Orbiter cabin reentry, safing activities 
consist of the following actions and precautions: 
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FIGURE 22. TUG/SEPS/SEOS CRASH/SHOCK LANDING AT KSC FLOW 





figure 23. TUG/SEPS/SEOS CRASH/SHOCK LANDING AT KSC TIME LINE 
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• Evacuate crew 

• Use fire suppressants where applicable 

• Perform preliminary Orbiter inspection 

• Inspect and monitor for hazardous materials leaks. 

After reentry to the Orbiter, the following operations are performed while 
the cargo is monitored: 

• Ensure that all Orbiter and payload systems have been 
deactivated and secured. 

• Perform Orbiter safety verification. 

• Ensure that auxiliary power is off. 

• Vent Tug main propellant tanks 

• Helium purge Tus propellant tanks and MLI. 

3 , 2. 6 Crash/Shock Condition Landing at Contingency Site 


This contingency differs from the crash/shock condition 
landing at KSC in a very important aspect --a landing at a contingency site 
imposes a new set of constraints on the Orbiter and cargo. The equip- 
ment required to perform a rudimentary level of safing is not available 
at the contingency site and must be flown in; the time element involved 
presents a hazard to the Orbiter and cargo. Also, any damages sus- 
tained may not be as accurately assessed and treated as they should be, 
thus compounding the inherent hazard associated with transporting the 
cargo back to KSC. 

3. 2. 6. 1 Time Line 

The crash/shock condition landing at a contingency site flow 
is shown in Figure 24. The time required from landing to transport to 
KSC depends upon the distance of the contingency site from KSC and, 
hence the time to arrival of personnel and essential equipment. The 
time line for this contingency plan is shown in Figure 25. 
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FIGURE 25. TUG/SEPS/SEOS CRASH/SHOCK LANDING AT ALTERNATE SITE TIME LINE 
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3. Z. 6, Z Safing Requirements 

The following Tug safing requirements are: 

• Vent Tug main propellant tanks 

• Helium purge Tug propellant tanks and MLl. 

3.3 lUS/F^PU/PJP CARGO CONTINGENCY PLANS 

3. 3. I Backout Operations at the Pad 


The backout operations for the IUS/F 2 PU/PJP cargo, like 
the normal processing of this cargo, present a number of unique situa- 
tions and hazards. Two of these hazards and their impact are: 

# The RTG*s on the PJP payload present a radiological 
hazard that requires that the number of personnel and 
access to the cargo be limited. The RTG’s also present 
a high temperature hazard if cooling is lost while in the 
cargo bay, A significant temperature rise in the cargo 
bay could adversely affect the thermal balance of the 
liquid fluorine oxidizer on the F 2 PU. Loss of RTG 
cooling is covered in Paragraph 3. 4. 

m The design concept of the liquid fluorine oxidizer system 
on the F^PU payload is a blowdown type where the internal 
pressure is maintained by internal cooling supplied by an 
external LN 2 supply. Venting or boiloff of the LF 2 tank is 
an emergency procedure only. However, a vent and 
fluorine disposal system must be provided at the pad in 
case of a fluorine Teak or overpressurization of the LF 2 
tank. 

If the backout contingency is initiated by a malfunction of the liquid 
fluorine oxidizer system, provisions for pressure relief, venting, and 
draining of the LF 2 system must be available at the pad. The design of the 
pad vent system and fluorine oxidizer system should allow gas and liquid 
to be drained. If the integrity of the fluorine oxidizer system is sound, 
draining at the pad is not recommended. This recommendation is based 
on the requirement that the loaded LF 2 tank pressure be maintained at a 
low pressure (small positive pressure) until released from the Orbiter 


51 


WTELEDYNE 

BROWN ENGINEERING 


in space. Processing and launch of a LiF 2 near operating pressure 

(250-350 psi) should be avoided since this is in direct violation of Shuttle 
safety guidelines and exposes ground personnel and the Orbiter to a 
hazard with potential catastrophic effects. 

The operations required to perform the general backout con- 
tingency for the IUS/F 2 PU/PJP cargo are shown on Figure 26. This 
contingency is not initiated by a malfunction of the liquid fluorine oxidizer 
system. After Orbiter and lUS safing, the major concern for this 
contingency is maintaining the fluorine cooling, exposure to RTG 
radiation, and pyrotechnic devices. In the plan for this contingency, a 
portable LN 2 servicer cooling system is connected to the fluorine 
propulsion unit in the PCR. 

If the handling of an LN 2 servicer in the PCR and in the 
canister or in conjunction with the canister appear too unwieldy, 
rather than connect the fluorine stage to an 1 jN 2 servicer at the point 
shown in the alternative flow (within PCR), it may be possible to 
reconnect after the canister has been installed on the transporter, 

TRW estimates, based on a preliminary LF 2 tank configuration, that 
the tank pressure will remain within an acceptable value up to 6 hr 
after its cooling medium is disconnected. 

3. 3. 1. 1 Time Line 

The time line and sequence of operations required to perform 
the backout contingency are shown in Figure 27. The time from 
initiating the backout contingency to arrival at SAEF #1 with the cargo 
is approximately 42 hr. Propellant dumping for the cargo and 
Orbiter are performed sequentially to reduce the possibility of a fire 
hazard from leakage of reactants. The pad is closed when the con- 
tingency is initiated. 

3. 3. 1. 2 Safing Requirements 

The following summary of the constraints and safing 
requirements that must be performed during the backout contingency is: 

• Drain and purge lUS N20^ and lines. 

• Drain and purge lUS and F 2 PU hydrazine tank and lines. 

• Vent lUS tank pressurizing systems. 
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FIGURE 27. lUS/F PU/PJP BACKOUT OPERATIONS TIME LINE 
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• Unload ET LOX and LH 2 tanks and purge. 

• Open pad. 

• The payload N^O and N 2 H^ servicing units described 
in Volume 3 should provide for draining, purging, 
and drying of the propellant tanks and safe disposal 
of the propellant effluents. 

• Connect payload service lines and vent F^PU, PJP, and 
lUS APS pressurants. 

• Before the doors are opened, the absence of hazardous/ 
toxic gases should be verified. A hazardous gas 
analyzer system that would determine the presence 

of all gases is desirable. 


After access to the cargo bay is attained via the PCR, two 
basic approaches are available. The first is to remove the cargo as 
quickly as possible, safe ordnance devices, and remove RTG's at 
SAEF #1. This requires RTG cooling during transport in addition 
to the fluorine cooling. The preferred approach, as shown in the 
contingency flow, is as follows: 

• Disconnect and short Class A Explosives (EED's). 

• Remove RTG's. 

• Disconnect cargo umbilicals from the Orbiter. 

• Remove payload. 

This approach limits, as much as practical, the interaction 
of potential hazards and limits the number of personnel exposed to the 
various hazards. 

3. 3. 2 Vertical Changeout at the Pad 

This contingency plan is inherently complex because of the 
hazardous materials used in the payload comprising the cargo and is 
further complicated by the various options that were considered in 
dealing with the payload changeout combinations. Four options were 
developed as part of this contingency plan: 
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• Changeout of the PJP only. 

• Changeout of the F 2 PU/PJP. 

• Changeout of the lUS/ F^PU/ PJP cargo with the PCR 
capable of handling one cargo at a time. 

• Changeout of the IUS/F 2 PU/PJP cargo with the PCR 
capable of handling two cargoes at a time. 

The operations required to perform these four contingency 
operations are shown in Figure Z8. This figure shows the operations, 
common to all four options, required to safe the Shuttle and payload before 
access is gained to the payload bay through the payload changeout room, 
and the operations required for the four vertical changeout options. 

3, 3. 2. 1 Time Lrine 

The time line and sequence of operations for the four change- 
out options are given below. 

3. 3. 2. 1. 1 Changeout of PJP Only 

This contingency operation requires that the RTG's be removed 
from the original PJP and installed on the new PJP unit. Also, the RTG's 
cooling system has to be removed prior to the changeout of the PJP*s 
and reinstalled afterwards. 

The time line and sequence of operations required to perform 
changeout of the PJP payload are shown in Figure 29. The time required 
from initiation of this contingency to return to normal operations at 
Shuttle and payload propellants loading is approximately 36 hr. 

3. 3. 2. 1. 2 Changeout of F 2 PU and PJP 

In this option, the F^PU/PJP assembly would be changed out 
for an identical unit. In addition to the RTG's cooling problem dis- 
cussed in the first option, an even more critical problem is associated 
with the cooling requirements for the F 2 PU. 
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FIGURE 28. lUS/F PU/PJP VERTICAL CHANGEOUT AT THE PAD FLOW (SHEET 2 of 7) 
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This unit requires a special servicer to accompany the fluorine 

stage throughout the operations until it is connected to the cargoes 
fluorine refrigeration system. The mobile servicer is then 

connected to the fluorine stage of the F^PU/PJP that was just changed 
out, prior to its transfer back to the loading facility for safing and 
de servicing. The time line and sequence of operations required to 
perform this changeout are shown in Figure 29. The time required 
from initiation of this contingency to return to normal operations at 
Shuttle and payload propellants loading is approximately 36 hr, 

3. 3. 2. 1, 3 Changeout of the Entire lUS/F^PU/PJP with One Cargo 

at a Time in the PCR 

In this option, the assumption is made that an entire cargo 
of identical composition will be exchanged for the original. It is 
further assumed that the RTG's will be taken off the first cargo and 
installed on the new. As in the previous option, RTG's cooling and 
the fluorine stage cooling are the big problems. The time line and 
sequence of operations required to perform this changeout are shown 
in Figure 30. The time from initiation of the contingency operation to 
launch of a new cargo is approximately 73 hr, 

3. 3. 2, 1. 4 Changeout of the Entire lUS/F^PU/PJP with the PCR 

Capable of Handling Two Cargoes 

In the final option to this contingency, the same assumptions 
were made as in option three, with the additional requirement that the 
PCR accommodate two cargoes at the same time. This option requires 
only one extension and retraction of the PCR, whereas in option three 
two extensions and retractions were required. The largest impact will 
be on the design of the PCR. It will require two cargo holding structures 
to be added to the PCR and possibly a more capable payload manipulator 
with added degrees of freedom. From a hazard point of view, the fluorine, 
hydrazine, and other hazardous materials concentrations will be com- 
pounded by having two cargoes in the PCR simultaneously. Also, the 
original cargo that was removed from the Orbiter will have to remain 
in the PCR throughout launch or a holdup of four additional hours will 
be required to remove the original cargo from the PCR and pad area 
prior to launch. The time line and sequence of operations required 
to perform this contingency operation are shown in Figure 31. The 
time from initiation of the contingency operation to launch of a new 
cargo is approximately 64 hr. 


66 



I Ml I I I II I I Tiirri TI 1 I M Ml M Ml M I f I I ( Hf M I I I I , 

tus AND r,!>u TANKS AND PDucE:||iM|l I VERTICAL CHANGEOUT CONIlNCtNCY OPERATIONS 



FIGURE 30. lUS/F^rU/PJP VERTICAL CHANGEOUT AT THE PAD TIME LINE 

(ONE CARGO IN THE PGR) 

L7- ^ 




FUEL CELL CP YOOENlC SERVICE 



FIGURE 31. lUS/F^PU/PJP VERTICAL CHANGEOUT AT THE PAD TIME LINE 
(TWO CARGOES IN THE PCR) 
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3. 3. 2. 2 Safing Requirements 

The safing requirements for vertical changeout of the 
lUS/F^PU/PJP are similar to those for backout operations discussed 
in Paragraph 3. 3. 1. The major steps in the preferred sequence are: 

• Remotely safe Shuttle and payload by draining propellants 
and venting pressures (except for LrF 2 ). 

• Verify no toxic/hazardous gases present in the cargo 
bay before entering. 

• Safe all ordnance (with shorting plugs), 

• Remove RTG’s. 

• Remove cargo/payloads. 

3. 3, 3 Mission Abort 


In this contingency our primary concern is with the cargo 
and its safing. Since the abort can take place at various points in the 
mission, cargo related safing must be examined for the worst case. 

Abort situations of concern are the inability to deploy the cargo (payload bay 
doors will not open or cargo will not deploy or separate) and failure to 
attain orbit. The worst case abort for any cargo based on time available 
for safing is abort at SRB separation. However, for this mission abort 
from orbit is of concern because this cargo carries onboard a limited 
supply of cooling water for the PJP RTG's and a limited supply of 
for the fluorinated oxidizer system. 

The operational flow for the in-flight safing activities for the 
cargo are shown in Figure 32, 

3. 3. 3. 1 Time Line 

The mission abort contingency flow through landing is shown 
in Figure 33 . 

3. 3. 3. 2 Safing Requirements 

The following recommended safing requirements for in-flight 
mission abort of this cargo are: 
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FIGURE 33. lUS/F^PU/PJP MISSION ABORT TIME LINE 
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• Dump out lUS ^20^ and N 2 H^ through the Or biter 
vent system and repressurize the tanks to a 
positive pressure for landing. 

• Dump F 2 PU MPS hydrazine through the Orbiter vent 
system and repressurize the tank to a positive 
pressure for landing. 

• Vent lUS, F 2 PU, and PJP APU pressurants over- 
board through the Orbiter vent system. 

• Monitor payload caution and warning parameters. 

The requirements for dumping of the LF^ tank in-flight are 
being considered in other NASA studies. Even though the fluorine stage 
probably presents the largest hazard upon landing, no overboard fluorine 
dumping was shown in the mission abort plan because fluorine is highly 
reactive and a special fluorine dump system would be required; the 
environmental impact of such an action has not been assessed; and as 
long as the fluorine system is stabilized and controlled, the hazards 
may be less in this state than in the dump mode. However, fluorine 
dump provisions should be provided for in-flight venting in the event 
that the fluorine system becomes uncontrollable. 

3. 3. 3. 3 lUS/F^PU/PJP Contingency Special Support Equipment 
3. 3. 3. 3. 1 RTG Cooling 

The nominal post- landing Orbiter time line shows that 19 hr 
is required from landing until access is gained to the payload in 
the OPF. With only 15 hr of water supply onboard this cargo for 
cooling the RTG's, provisions must be made at the landing site for 
RTG cooling. It is recommended that this requirement be fulfilled 
with a mobile water cooling servicer since an abort landing may 
require additional time at the landing site. 

3. 3. 3. 3. Z Fluorine Oxidizer Tank Cooling 

An abort landing of the IUS/F 2 PU/PJP cargo requires that 
special consideration be given to the fluorine oxidizer whether in-flight 
dumping is performed or the LF 2 tank is returned intact. Because 
there are presently no provisions for handling fluorine in the OPF, the 
following options are available; 
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a. Provide onboard LN^ cooling supply or portable LN2 
dewar at the landing site to maintain tank thermal/pres- 
sure balance until the F^iPU can be removed from the 
Orbiter, demated, and transported to the fluorine 
facility. This would require, under normal operations, 
a minimum of 19 hr and exposes the Orbiter, OPF 
facility, and operating personnel to the fluorine hazard. 
Contingency operations resulting in an abort landing 
could require additional time. 

b. Vent and dispose of the fluorine at the landing strip. 

This action requires a portable fluorine disposal unit 
(charcoal burner), portable vent lines for connecting 
the Orbiter fluorine vent to the fluorine disposal unit, 
a heated GN2 mobile servicer to be connected to the 
L(F2 tank ground cooling umbilical to boil off the LF 
and a GN2 supply to purge the LF2 tank. Previous 
studies report that boiloff time for similar fluorine 
upper stage concepts using the heated GN2 method 
would require approximately 6 hr. 


The final recommendation as to the handling of the fluorine 
oxidizer in the event of an intact abort depends largely on whether in- 
flight dumping is required or allowed. The effects on the environment 
and ecology of dumping fluorine into near space should be studied. 
Dumping in-flight would reduce the time required at the landing strip to 
vent residual LF^ and allow the post landing operations to proceed 
without the 6 -hr delay required by option b. Another possible design 
impact resulting from an abort with a fluorinated oxidizer system is 
that provisions must be made for such an emergency to be able to drain 
in the horizontal position. 

3 . 4 ACCIDENT CONTINGENCY --LOSS OF RTG COOLING FOR 

THE PJP ON THE IUS/F2PU/PJP CARGO ' 

This is an accident -type contingency situation where the 
undesired event is loss of RTG cooling after installation in the payload 


73 



^y^TELED/NE 

BROWN ENGINEERING 


bay. The normal processing flow developed for this cargo (Volume 3) 
established RTG installation at the pad at 14 hr before lift-off. The 
RTG's are cooled by a ground water supply through the T-0 umbilical 
until just before lift-off when the onboard supply is activited. The 
onboard cooling water supply has tentatively been established for 
1 5 hr of cooling. 

3. 4. 1 Contingency Remedial Options 

Upon detection of the RTG cooling water system malfunction 
on the ground, two basic options are available. In the first option, the 
malfunctioned cooling system must be shut down and safed followed by 
backout operations. The second option also requires that the cooling 
system be shut down and safed. If the decision is to proceed with normal 
operations rather than backout, then either the entire RTG cooling unit 
can be replaced or if less time is required, the unit could be repaired. 
These options are shown in the following diagram: 



The effect of the RTG's loss of cooling is overheating in the Orbiter 
bay. Probably the highest potential impacts are on the RTG unit and 
the fluorine stage, with the possible release of radiation and loss of 
control of the delicate fluorine heat/ pressure balance. The worst 
case condition for this failure would require approximately 18 hr. 
of Shuttle and cargo safing from initiation of a contingency until 
access to the payload bay is attained via the PGR (Figure 27). 
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3. 4. 2 RTG Cooling System Definition 

To establish the fundamental safing operations for this con- 
tingency, a likely candidate cooling system for the RTG's was devised. 
The basic requirements for this system are shown in Figure 34, Such 
a system must have, as a minimum, the following: 

• On-pad water supply 

• Pump 

• RTG cooling water jackets 

• Overboard dump valve 

• Water boiler and heat exchanger 

• RTG jacket water valve 

• Boiler feed valve 

• Water storage tank onboard Orbiter 

• Pressure and temperature sensors in water cooling 
loop 

3. 4. 3 Contingency Failure Modes and Effects 

This contingency can be brought into effect during ground 
operations by any one of the following: 

• LrOss of on-pad water supply 

• Rupture of RTG cooling jackets, lines, or fittings 

• Overboard dump valve fails to water boiler position. 

Except for rupture of the RTG cooling water jackets or lines, a transfer 
to the onboard supply would provide cooling until the backout contingency 
through removal of RTG's could be completed. 
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After transfer to the onboard cooling supply, this contingency 
can be brought into effect by any one of the following failures: 

• Rupture or leakage of RTG cooling water jackets or lines 

• Pump failure 

• Boiler rupture or leakage 

• Rupture of heat exchanger 

• Failure of overboard dump valve to open to dump or to 
boiler 

0 Failure of boiler feed valve to open to boiler or to 
cooling loop 

• Rupture or leakage of water storage tank 

• Failure of RTG jacket water valve to open when required 

• Malfunctioning or false reading of pressure and/or 
temperature indicators to the C&W system. 

With the exception of failure of the overboard dump valve and rupture 
or leakage of RTG cooling water jackets and lines, a transfer back to 
the on pad water supply can provide cooling until the backout contingency 
allows removal or repair of the RTG cooling systems. As a minimum, 
the following redundancy provisions should be included in the cooling 
system design: 


• Pipe on -pad water supply to the RTG jackets independ- 
ent of the on-board supply. 

• Provide redundant overboard dump valve 

Also, the integrity of the RTG coolant jackets and system should 
be verified by a pressure/leak test prior to installation of the RTG*s, 

3, 4. 4 Fault Isolation^-Ijoss of RTG Cooling 

The contingency action required depends upon which failure/ 
malfunction occurs. Several of the component malfunctions will require 
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the same actions. The detection of this contingency type requires a 
temperature measurement either on the RTG case, in the cooling loop 
or both. Therefore, heat sensor s, monitorable through the C&W 
system, are required. If an overheating condition is detected but with 
no pressure loss in the cooling loop, then the probable source of trouble 
is with a leak or rupture of the water boiler or storage tank. Since it 
would require an elaborate monitoring and control system to fault isolate 
every major component in the cooling system, a more practical solution 
is to make some worst case assumptions as to the faulty items and 
proceed with the shutdown and safing of the cooling water system. If 
there is a rupture of the boiler, the action required is to shut off water 
from entering the boiler. Because there is no way to drain, or more 
rapidly deplete it, the boiler must be allowed to exhaust itself as vapor 
and through leakage until empty. If there is a leak or rupture of the 
water storage tank, the procedure would be to deplete the tank, by way 
of the overboard dump, as rapidly as possible to minimize water leak- 
ages on the cargo and in the Orbiter bay. If the pressure indicator 
within the cooling loop has indicated a pressure loss, the malfunction 
is either a pump failure, or a rupture of the cooling water jackets or 
heat exchanger, which would require a shutoff of water to and draining 
of water from the cooling loop. 

3. 4. 5 Contingency Flow Plan 

After the remote operations on the RTG cooling water system 
have been completed, basic backout operations are initiated. When the 
Orbiter bay doors have been opened, the RTG cooling water system can 
be inspected and a decision made as to whether to continue the backout 
operations or to repair / replace and proceed with the normal processing. 
The operational requirements for this contingency are shown in Figures 35 
and 36. 

3, 5 SPECIAL SUPPORT EQUIPMENT 

Special support equipment is unique equipment recognized as 
essential for the successful application of the contingency plans. These 
items have not been previously called for in the normal processing plans 
and thus are peculiar to their respective contingency situations. 

For each cargo, a listing of special support equipment for 
each contingency plan is provided. Sixteen items of support equipment 
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or facility modifications have been recognized as a result of the con- 
tingency plans. The essential requirements for each item are provided 
on the Support Equipment Identification sheets. The title, basic function, 
and description of each item are shown on the sheets designated C-1 
through C - 16. 
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SPECIAL SUPPORT EQUIPMENT PER CONTINGENCY PLAN 


CARGO IDENTIFICATION spacelab/atl 

CONTINGENCY PLAN SPECIAL SUPPORT EQUIPMENT 


Vertical Changeout At The PAD 


2. Bac Dut Operations 


3. Mis .on Abort 


4, Normal Landing At Contingency Site 


5. Crash/Shock Condition Landing 
At KSC 

6. Crash/Shock Condition Landing 
At Contingency Site 


C-1 Orbiter Bay Vertical Access 

Mechanism and Work Platform 


C-1 Orbiter Bay Vertical Access 

Mechanism and Work Platform 


NONE 


C-2 Interior Access Assembly 

C-3 Mobile Power Generator 

C“4 Portable Orbiter Hoisting Device 

C-5 Orbiter Strongback 

C-6 Piggyback Carrier Aircraft 


C-2 Interior Access Assembly 
C-3 Mobile Power Generator 


C-3 Mobile Power Generator 

C-4 Portable Orbiter Hoisting Device 

C-5 Orbiter Strongback 

C-6 Piggyback Carrier Aircraft 
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SPECIAL SUPPORT EQUIPMENT PER CONTINGENCY PLAN 


CARGO IDENTIFICATION 

TUG/SEPS/SEOS 

CONTINGENCY PLAN 

SPECIAL SUPPORT EQUIPMENT 


Vertical Changeout At The PAD C-1 Orbiter Bay Vertical Access 

Mechanism and Work Platform 


2 . Backout Operations 

C-1 Orbiter Bay Vertical Access 

Mechanism and Work ^latform 

3* Mission Abort 

NONE 

4. Nermal Landing At Contingency Site 

C-3 Mobile Power Generator 

C-4 Portable Orbiter Hoisting Device 

C-5 Orbiter Strongback 

C-6 Piggyback Carrier Aircraft 

5. Crash/ Shock Condition Landing 

At KSC 

C-3 Mobile Power Generator 

6. Crash/shock Condition Landing 

At Contingency Site 

C-3 Mobile Power Generator 

C-4 Portable Orbiter Hoisting Device 

C-5 Orbiter Strongback 

C-6 Piggyback Carrier Aircraft 
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SPECIAL SUPPORT EQUIPMENT PER CONTINGENCY PUN 


CARGO IDENTIFICATION ius/F2pu/pjp 

CONTINGENCY PLAN SPECIAL SUPPORT EQUIPMENT 


1. Vertical Changeout At The PAD 


2. Backo‘ Operations 


3. Mission Abort 


C-1 Orbiter Bay Vert. Access Mech. 

C-7 RTG Handling Ring 

C-8 RTG Handling Ring Sling 

C-9 RTG Support Yoke 

C-10 RTG Handling Dolly 

C-11 RTG Handling Rod 

C-12 PCR Cargo Handling Fixtures 

C-13 Modified Payload Manipulator 


C-1 Orbiter Bay Vert. Access Mech. 

C-7 . RTG Handling Ring 

C-8 RTG Handling Ring Sling 

C-9 RTG Support York 

C-10 RTG Handling Dolly 

C-11 RTG Handling Rod 

C-12 PCR Cargo Handling Fixtures 

C-13 Modified Payload Manipulator 


C-14 Mobile H 2 O Cooling Unit 
C-15 Hot GN^ Servicer 

C-16 Portable LN 2 Supply and Transfer 
Kit 

F-1-25 Fluorine Vent System 


4, Accident Contingency - | SAME AS ITEM 2. 


Loss of RTG's Cooling 
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SUPPORT EQUIPMENT LISTING 

UNIT/ CATEGORY 

Special Support Equipment Required For Contingency Planning 

LIST NUMBER 
C 

SUPPORT 

EQUIPMENT: 


0 

Orbiter Bay Vertical Access Mechanism And Work Platform 

1 

0 

Interior Access Assembly 

2 

0 

Interior Access Assembly ( Alternate ) 

2a 

0 

Mobile Power Generator 

3 

0 

Portable Orbiter Hoisting Device 

4 

0 

Orbiter Strongback 

5 

0 

Piggyback Carrier Aircraft 

6 

0 

RTG Handling Ring 

7 

0 

RTG Handling Ring Sling 

8 

0 

RTG Support Yoke 

9 

0 

RTG Hand 1 ing Dolly 

10 

0 

RTG Handling Rod 

11 

0 

Payload Changeout Room Cargo Handling Fixtures 

12 

0 

Modified Payload Manipulator 

13 
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SUPPORT EQUIPMENT IDENTIFICATION 


TITLE: 

ORBITER BAY VERTICAL ACCESS MECHANISM AND 
WORK PLATFORM 

FUNCTION; 

The function of this structure is to provide maintenance personnel and technicians 
an access to the cargo and cargo bay when the Orbiter is in the vertical position 
at the PAD. 


ITEM NUMBER: 
C-1 


DESCRIP- ON: 

This lit shall be an integral part of the PCR or otherwise be substantially 
moun d to it. It shall be capable of vertical and horizontal movement and 
later motion by means of a telescoping boom. The unit shall be provided 
with oucket or basket attached to the boom to hold personnel. The controls 
shaL -e operable from the bucket by the maintenance personnel. 


EXPERIMENT □ 
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SUPPORT EQUIPMENT IDENTIFICATION 


TITLE: 


ITEM NUMBER; 


INTERIOR ACCESS ASSEMBLY C-2 

FUNCTION ; 

The function of this item is to provide supported capability to enter or leave the 
Spacelab through the Spacelab Crew Transfer Tunnel or segments of the tunnel 
while in the horizontal configuration under 1 g conditions. 


DESCRIPTION; 

The interior access assembly will consist of folding metal platforms w lich will 
attach to the IVA handrails in the tunnel to provide a crawl platform fo ingress/ 
egress. The platform segments will be designed for ease of installatit n with the 
tunnel either installed or not installed in the Orbiter. Their length will be 
compatible with all possible tunnel configurations. 
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SUPPORT EQUIPMENT IDENTIFICATION 


TITLE: 

ITEM NUMBER: 

INTERIOR ACCESS ASSEMBLY (ALTERNATE) 

C-2a 

FUNCTION: 

The function of this item is to provide supported capability to enter 

or leave the 


Spacelab through the Spacelab Crew Transfer Tunnel or segments of the tunnel 
while in the horizontal configuration under 1 g conditions. 


DESCRIPTI^ : 

The Int 'lor Access Assembly will be designed to provide a flat surface inside 
the Tun 3 for personnel access into the tunnel. The assembly will be contoured 
to the c r' ature of the tunnel to distribute the personnel weight and prevent damage 
to the i a ior surface. The access assembly will be designed in length to 
accomr >date either a tunnel segment or an assembled tunnel. 






1 

SUPPORT EQUIPMENT IDENTIFICATION 

TITLE: 

ITEM NUMBER: 

MOBILE POWER GENERATOR 

C-3 

FUNCTION: 


The function of this unit is to provide power to certain critical instrumentation 

for status display. 

1 


DESCRIPTION: 

This power generator system shall have compatible connectors to mate vith 
Orbiter connectors. The unit must have the capability of providing pow r to 
certain instrumentations for monitoring of critical parameters. 


Access to boat tail of Orbiter for hookup could be provided by ladders 
via fire truck. 
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SUPPORT EQUIPMENT IDENTIFICATION 


TITLE: 

ITEM NUMBER: 

PORTABLE ORBITER HOISTING DEVICE 

C-4 


The function of this unit is to lift the Orbiter from the landing strip, translate, 
and position it onto a carrier aircrafts piggyback holding structure. 


DESCRIPTl 1: 


This e< ipment shall have hoisting capability greater than 200,000 lb and be 
capabk Df sufficient lat-ral movement to achieve the above described function. 

It shall Iso be designee for rapid assembly and disassembly. When disassembled, 

it shall e packaged for stowage and shipment in the Orbiter' s carrier aircraft's 
cargo c -npartment. 


The sketch illustrates a guy derrick as one possible arrangement of such 
a mobile structure. 
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SUPPORT EQUIPMENT IDENTIFICATION 


ITEM NUMBER: 
C-5 

FUNCTION : 


TITLE: 

ORBITER STRONGBACK 


The function of this structure is to support the Orbiter at the forward and aft load 
beam attach points so that the Orbiter can be hoisted while in the horizontal mode. 


DESCRIPTION: 


This unit shall be attached at four load points. It may be a rigid structur or could 
be a sling arrangement. 



EXPERIMENT | | 


FACILITY □ 



GSE 
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SUPPORT EQUIPMENT IDENTIFICATION 


TITLE: 


ITEM NUMBER: 


PIGGYBACK CARRIER AIRCRAFT 


FUNCTION; 


The function of this aircraft is to ferry the Orbiter from an alternate site to KSC. 


This arrier aircraft shall be capable of carrying a gross weight in excess of 200, 00( 
lb. , .e aircraft shoi id be a Boeing 747 or similar aircraft capable of being 
conve t» d. Modificat ons must consist of truss-work to distribute the weight of the 
two p g_ uack load pomts throughout the aircraft's basic load bearing structure. 

Both jre and aft locations where the Orbiter's attachments will be mounted shall 
be ct npatible with the Orbiter's ET attachment points. 
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SUPPORT EQUIPMENT IDENTIFICATION 


TITLE: 


ITEM NUMBER: 


RTG HANDLING RING 


FUNCTION: 

The RTG handling ring procides a means of handling a pair of connected RTG's 
from the center of the pair. It is used during most handling operations. 


DESCRIPTION: 

The RTG handling ring shall be hexagonally shaped and composed of rect* ngular 
aluminum tubing. Three quick disconnect fittings on the ’ ing frame shal match 
holes on the delta frame structure. Trunnion shafts on the ring shall int» rface 
with bearing brackets on the RTG Support Yoke, Attachment brackets shall be 
provided at the ends of the trunnion shafts for connection of a RTG Handling Ring 
Sling. 


46 0 
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SUPPORT EQUIPMENT IDENTIFICATION 


FUNCTION: 

The function of the RTG handling ring sling when used in conjunction with overhead 
cranes and a handling ring is to handle a pair of connected RTG's. 


DESCR: :iON: 

The Ting shall con st of a straight beam with a wire rope cable suspended from 
eac e .'d. Fork em ; on the cables shall be compatible with attachment brackets 
on t i 'handling ring These brackets shall allow the RTG's to be rotated from a 
vert to horizont i atlitude while suspended from the sling. 



ITEM NUMBER: 
C-8 


TITLE: 

RTG HANDLING RING SLING 





SUPPORT EQUIPMENT IDENTIFICATION 


FUNCTION : 

The function of the RTG support yoke (when used in conjunction with a handling 
ring) is to support a pair of connected RTG^s, 


DESCRIPTION: 

RTG support yoke is a shaped structure mounted on a t ibular post that 

supported. in a socket that is attached to a base plate. The iTG^s are capa ble 
of being rotated in the yoke and locked in position. 



See Support Equipment Identification item number C-7 for sketch of RTG 
Support Yoke. 


ITEM NUMBER: 
C-9 


TITLE: 

RTG SUPPORT YOKE 
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SUPPORT EQUIPMENT IDENTIFICATION 

ITEM NUMBER: 
C-10 

FUNCT ION : 


TITLE: 

RTG HANDLING DOLLY 


The function of the RTG handling dolly is to provide mobile support for a pair 
of RTG*s while they are mounted in an RTG Support Yoke. 


DESCRII [ON: 

This :em shall consi ^t of a steel platform approximately 30 by 36 in. , mounted 
on ru ber tread castt rs 8 to 10 in. in diameter. It shall be manually 
contr lied by a remo' able handle. A socket shall be provided on the platform 
to ma ch the vertical oost on the yoke. With the vertical post removed, the 
RTG^ mounted on tht delta frame-bipod assembly are bolted to the dolly bed 
for t asportation. 
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SUPPORT EQUIPMENT IDENTIFICATION 


TITLE; 


RTG HANDLING ROD 


ITEM NUMBER: 
C-11 


FUNCTION : 


RTG Handling Rod is used to hold a pair of RTG's in a horizontal position while 
the pair is passed through the fairings and mated to the PJP spacecraft. 


DESCRIPTION: 


1 I 

- 


4.0 1- — 14,0 

1 



RTG handling rod— 

(view looking down) 


WT 20 LBS 
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SUPPORT EQUIPMENT IDENTIFICATION 

TITLE: 

ITEM NUMBER: 

PCR CARGO HANDLING FIXTURES* 

C-12 

FUNCTION: 


The function of the handling fixture is to hold a cargo in the vertical position 

in the PCR. 



descrip: D. : 


Two rgo handling fix ures should be built into or otherwise made an integral 
part tne PCR. One jf these units shall hold a secondary cargo to be exchanged 

for t : primary cargo m the event the latter is to be removed. The other unit 
shall old the first cargo during the exchange transaction required to remove it 
fron ae Orbiter Bay and to install the second. These fixtures shall hold the 
carg by installing it to the cargo flight attachment points in the same mode as 
in the Orbiter Bay. 


'I' Required only if vertical changeout at the PAD is to be accomplished by having 
the PCR accommodate two cargoes simultaneously. 
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SUPPORT EQUIPMENT IDENTIFICATION 


TITLE: ITEM NUMBER: 

MODIFIED PAYLOAD MANIPULATOR =:= C-13 


FUNCTION ; 

To hold, handle, naove, and position a cargo in the PCR. 


DESCRIPTION: 

The modified payload manipulator, in addition to the movement in and out of the 
Orbiter bay, shall also have the capability of a side to side movement. The 
manipulator shall be able to attach to and pick up a cargo in the Orbiter Ba\ , 
back out into the PCR, turn 90°, and move the cargo into a PCR cargo handling 
fixture. This process shall also be reversible. 


^Required only if the vertical changeout at the PAD is to be accomplished by 
having the PCR accommodate two cargoes simultaneously. 
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SUPPORT EQUIPMENT IDENTIFICATION 


TITLE: 


ITEM NUMBER: 


MOBILE H^O COOLING UNIT C-14 

FUNCTION: 

The function of the Mobile H^O Cooling Unit is to provide cooling water to the 
RTG's Cooling System. 


DESCRII ;0N: 

This lobile cooling u it shall consist of a tank trailer assembly with compatible 
hose onnections to th a Orbiter /cargo interface with pump and flow regulation 
capa: lilies. The uni could be towed by an attachment to the Orbiter tow vehicle 
or p ered by a separate tow truck that would be driven along with the Orbiter, 


EXPERIMENT □ 
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SUPPORT EQUIPMENT IDENTIFICATION 





TITLE: 

ITEM NUMBER: 

HOT GN^ SERVICER 

C-15 

FUNCTION : I 


The function of this unit is to provide heated GN^ to the lUS L-F 2 tank to accelerate 
the boil off of gaseous fluorine. 


DESCRIPTION: 

The unit shall include a mobile tank with heating capability that can be conn ^cted 
to the portable GN^ supply and transfer kit. It shall consis: of appropriate 
transfer lines for interfacing with the GN 2 supply and the Orbiter /car go. I. shall 
include temperature indicators and controls and flow indicators. 
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SUPPORT EQUIPMENT IDENTIFICATION 


TITLE: item NUMBER: 

PORTABLE LN^ SUPPLY AND TRANSFER KIT C-16 

FUNCTION : 

The function of this kit is to provide means of transporting, connecting to 
Orbiter, and transferring LN 2 to pressurize and/or purge tanks and lines. 


DESCRI ION: 

The it shall include a mobile tank, transfer lines, control valves, sensors, 
inter a e connections, Tow indicators, etc. 


EXPERIMENT 



FACILITY □ 



GSE 
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3. 6 FACILITY PROTECTION AND PERSONNEL SAFETY 

In most cases, contingency processing plans require 
inherently more hazardous operational sequences than do the normal 
processing plans. The contingency plan is used in extreme emergency 
conditions (an accident or schedule failure) when the normal processing 
plan is, of necessity, temporarily abandoned. Therefore, a contingency 
plan requires emergency action under stress conditions that are not con- 
ducive to good safety practices but where such practices are needed the 
most. Every effort has been made to provide the safest plan for each 
contingency situation that is also the least time consuming. Safing 
requirements for each contingency flow have been identified in previous 
sections of this report. 

In the description of the special support equipment, human 
factors, personnel safety, and facility protection were considered and 
called out as required. Even though contingency plans often require 
more risky operations than normal processing plans, the same pre- 
cautions and prudent actions by personnel should be exercised, such as 
the use of personal protective gear and clothing and the following of 
safe operational practices. 

Volume 5 provides six sections devoted to i^^-pplicable opera- 
tional safety criteria: 

• RTG Operational Safety Criteria .... Section 3, Z, 2 

• Electrical Operational Safety 

Criteria Section 3. Z. 4 

• Pyrotechnic and Solid Propellant 

Motors Operational Safety Criteria. . . Section 3. 2. 6 

• Liquid /Gas Propulsion and Auxiliary 

Propulsion Equipment Operational Safety 

Criteria Section 3. 2. 8 

• Toxic Fluids /Gases Operational Safety 

Criteria Section 3. 2. 9 

• General Safety Criteria Applicable to 

Payloads Section 3. 3 
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The safety criteria contained in Volume 5 is the result of the 
synthesis of applicable safety requirements, guidelines, and criteria 
extracted from such documents as Kennedy Space Center Safety Practices 
Handbook, Shuttle Payload Ground Operations Safety Handbook, e,tc. , 
and tempered with the findings of this study. These criteria should be 
given consideration in any safety tradeoffs involving hazardous con- 
tingency plan operations. 
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